Use PowerShell to Process Dump an IIS w3wp Process

Sometimes processes go wild and you would like to collect information on them before killing or restarting the process. And the collection process is generally:

• Your custom made logging
• Open source logging: Elmah, log4Net, etc
• Built in logging on the platform (like AppInsights)
• Event Viewer Logs
• Log aggregators Splunk, New Relic, etc
• and, almost always last on the list, a Process Dump

Process dumps are old enough that they are very well documented, but obscure enough that very few people know how or when to use them. I certainly don’t! But, when you’re really confused about why an issue is occurring a process dump may be the only way to really figure out what was going on inside of a system.

Unfortunately, they are so rarely used that it’s often difficult to re-learn how to get a process dump when an actual problem is occurring. Windows tried to make things easier by adding Create dump file as an option in the Task Manager.

But, logging onto a server to debug a problem is becoming a less frequent occurrence. With Cloud systems the first debugging technique is to just delete the VM/Container/App Service and create a new instance. And, On-Premise web farms are often interacted with through scripting commands.

So here’s another one: New-WebProcDump

This command will take in a ServerName and Url and attempt to take a process dump and put it in a shared location. It does require a number pre-requisites to work:

• The Powershell command must be in a folder with a subfolder named Resources that contains procdump.exe.
• Your web servers are using IIS and ASP.NET Full Framework
• The computer running the command has a D drive
• The D drive has a Temp folder (D:\Temp)
• Remote computers (ie. Web Servers) have a C:\IT\Temp folder.
• You have PowerShell Remoting (ie winrm quickconfig –force) turned on for all the computers in your domain/network.
• The application pools on the Web Server must have names that match up with the url of the site. For example https://unittest.some.company.com should have an application pool of unittest.some.company.com. A second example would be https://unittest.some.company.com/subsitea/ should have an application pool of unittest.some.company.com_subsitea.
• Probably a bunch more that I’m forgetting.

So, here are the scripts that make it work:

• WebAdmin.New-WebProcDump.ps1
  
  Takes a procdump of the w3wp process associated with a given url (either locally or remote). Transfers the process dump to a communal shared location for retrieval.
  
• WebAdmin.Test-WebAppExists.ps1
  
  Check if the an application pool exists on a remote server.
  
• WebAdmin.Test-IsLocalComputerName.ps1
  
  Tests if the command will need to run locally or remotely.
  
• WebAdmin.ConvertTo-UrlBasedAppPoolName.ps1
  
  The name kind of covers it. For example https://unittest.some.company.com should have an application pool of unittest.some.company.com. A second example would be https://unittest.some.company.com/subsitea/ should have an application pool of unittest.some.company.com_subsitea.